We’ve all heard and read about how data analytics will be a big game changer for almost everything we do. For us “auditors” this is not necessarily a new idea or phenomenon. As early as the 1970’s (and in some circumstances even as far back as the Beatles era), auditors used data analytics to facilitate their engagements and help focus management attention on the key performance indicators needed to manage their business.
It was not uncommon for business management to be in awe of the information produced and requested that auditors turn over their programs to management so that the business could incorporate them into their service delivery strategies. These data analytical techniques were commonly referred to as computer audit assisted techniques or CAAT tools.
Some organizations and their professionals used and significantly benefitted from these tools. Process efficiencies, higher quality data, better decision making and automated monitoring were examples of benefits obtained. Unfortunately, many did not take advantage or ignored the data-derived benefits of these early “data analytical” tools. Whether audit, security or risk management professional, we’ve been hearing promises for over 35 years of how data analytics would change our world. Yet for the most part we have we not realized the promised benefits.
[ ALSO ON CSO: The CSO 2016 Security Data Analytics Survival Guide ]
I believe in data analytics and the cost benefits that it will provide for risk management professionals and their organizations. Yet, I am trying to understand why industry has been slow to adapt the data analytical tools that were available throughout the past 40 years. Can we learn from past challenges to make it happen this time? Or is this just a fad whose benefits will never be realized?
We can achieve the promised benefits by learning from the mistakes or “ghosts” of data analytics past. Here are issues that that the “collective we” must learn from and overcome to achieve the benefits of this promising technology.
1. Plan for the reality of corporate silos and the protection of executive “turf.” Division executives may be unwilling to give up control of data that can be used to manage their divisions or provide ammunition for internal competitors.
2. Respect the “Legitimate” data ownership concerns of certain businesses. Line management may be more attuned to the privacy issues that impact their division including unique regulatory requirements. A one size fits all approach for the entire organization may not be practical in these situations. Legitimate concerns over how these executives can ensure the continued protection of data entrusted to them should be appropriately considered and applicable risks managed to acceptable levels.
3. Appreciate that data analysis is not always a welcomed event for executives. Closet skeletons can provide much motivation that encourage “bad actors” to derail a worthy data analytic initiative.
4. Understand that executives do not get compensated based on their use of data analytics but rather the business results that they produce. Data analytics nor their associated business investments, although helpful, may not always be necessary to produce desired business results.
5. Don’t underestimate the skill and need of people who have the imagination and appreciation to leverage the analytic tools that are being made available. Investing significant amounts to identify issues that no one will understand how to use will result in disappointing initiative results.
6. Ensure the accuracy and completeness of the data that is being used. Bad source data will yield bad results negating the returns on any investments. Data that will be relied in to make strategic business decisions should be cleansed to the extent possible to minimize unintended results and wasted investments.
7. Verify the relevancy of the analysis to the specific challenge being analyzed. Results of analysis are a tool to support and not replace human judgment. Blindly following analytic results without properly challenging them could yield disastrous results. This would also include focusing efforts on getting the right answers to relevant questions.
The opportunities and potential benefits of data analytics are well documented. But the historical evidence also provides for the need for appropriate caution prior to making significant investments. By analyzing and understanding how data analytics have failed to meet promises in the past, we can hopefully leverage this tool and realize all the promised benefits that it can offer.
This article is published as part of the IDG Contributor Network. Want to Join?